Date filter is applying an extra hour to the timestamp

Elastic Stack Logstash
1

It seems the locale or timezone I'm using for the date filter is applying an extra hour to the timestamp.
The date filter is applied to the log_timestamp field and results in an extra hour applied:

I've tried both of these date filters but +1 hr always gets added to @timestamp`

date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS" ]
    locale => "en"
}

date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS ZZ" ]
    locale => "en"
    timezone => "GMT+0"
}

I've also tried to manually set a timezone for the log_timestamp field
add_field => [ "log_timestamp", "%{year}-%{month}-%{day} %{time},%{ms} +00:00" ]

How should I configure date filter so that the log_timestamp field and @timestamp match

2

What timezone are you in, i.e. what timezone is "July 8th 2015, 14:01:31.013" in? And what's the actual value of the @timestamp field rather than the possibly timezone-adjusted field that Kibana displays? The Kibana interface should allow you to look at the source message. (And why do you have two date filters with different timezone settings?)

3

Ah its the Kibana interface itself. I'm GMT+0100. Why is Kibana doing this?

So Kibana displays July 8th 2015, 14:04:24.418 however when I click into the JSON message I can see

"@timestamp": "2015-07-08T13:04:24.418Z",
"log_timestamp": "2015-07-08 13:04:24,418 +00:00"

NOTE I have only a single date filter. I just tried both versions to see if I could resolve this.

4

It looks like a bug to me. The date filter does not add the timezone to the @timestamp field.

This date filter:

date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSSZ" ]
    locale => "en"
    timezone => "GMT"
}

converts:
"log_timestamp": "2015-07-08 13:47:18,851+0000"

to:
"@timestamp": "2015-07-08T13:47:18.851Z"

And then Kibana will display the timestamp in its own timezone Z rather than the timezone of the original log statement provided by the field passed to the date filter.

5

The date filter does the right thing. The input timezone is UTC and the date filter always stores UTC in the @timestamp field so no adjustment is necessary. Kibana by default adjusts the UTC time to the local timezone for display purposes.

6

What about if I am storing logs that were generated in different timezones? I agree all timestamps will be in UTC in my elasticsearch. However kibana will display the data based on my web browser timezone. Imagine now my web browser is in a completely different timezone, every time I see a dashboard I have to think where those logs where generated and make time-maths to catch the real time :(.

7

You always have the option of saving the original timestamp or original timezone.

No matter what choice is made here (always use UTC or use local timezones) there will be problematic use cases.

1 Like